ICAO SMS M 02 - Basic Safety (R013) 09 (E)

Module N° 2 – Basic safety
concepts
Revision N° 13 ICAO Safety Management Systems (SMS) Course 06/05/09

Building an SMS
Safety Module 10
Phased approach to
SSP and SMS
Management Implementation
System Module 8 Module 9

SMS planning SMS operation
Module 5 Module 6 Module 7

Risks SMS regulation Introduction to SMS
Module 1 Module 22 Module 3

Module Introduction Module 4
SMS course Basic safety
Basic safety to safety Hazards
introduction concepts
concepts management
Module N° 2 ICAO Safety Management Systems (SMS) Course 2

Objective
 At the end of this module, participants will be able to explain

the strengths and weaknesses of traditional methods to
manage safety, and describe new perspectives and
methods for managing safety

Outline
 Concept of safety
 The evolution of safety thinking
 A concept of accident causation – Reason model
 The organizational accident
 People, context and safety – SHEL(L) model
 Errors and violations
 Organizational culture
 Safety investigation
 Questions and answers
 Points to remember
 Exercise Nº 02/01 – The Anytown City Airport accident
(See Handout N° 1)

Concept of safety
 What is safety?
 Zero accidents or serious incidents (a view widely held
by the travelling public)
 Freedom from hazards (i.e. those factors which cause
or are likely to cause harm)
 Attitudes towards unsafe acts and conditions by
employees of aviation organizations
 Error avoidance
 Regulatory compliance
 …?

Concept of safety
 Consider (the weaknesses in the notion of perfection)
 The elimination of accidents (and serious incidents) is
unachievable
 Failures will occur, in spite of the most accomplished
prevention efforts
 No human activity or human-made system can be
guaranteed to be absolutely free from hazard and
operational errors
 Controlled risk and controlled error are acceptable in an
inherently safe system

Concept of safety (Doc 9859)
 Safety is the state in which the risk of harm to persons or
property damage is reduced to, and maintained at or below,
an acceptable level through a continuing process of hazard
identification and risk management

Safety
 Traditional approach – Preventing accidents
 Focus on outcomes (causes)
 Unsafe acts by operational personnel
 Attach blame/punish for failures to “perform safely”
 Address identified safety concern exclusively
 Regulatory compliance
 Identifies:
WHAT? WHO? WHEN?
But not always discloses:
WHY? HOW?

The evolution of safety thinking
HUMAN FACTORS
TODAY
1950s 1970s 1990s 2000s
Fuente: James Reason

A concept of accident causation
Latent conditions trajectory

Actions
Activities
Factors
Resources ortoinactions
Conditions
that
over directly
protect
present
which by
in people
influence
any
against
the (pilots,
organization
system
the
the risks controllers,
efficiency
before
has
thata maintenance
organizations
the
of
reasonable
people
accident,
in degree
made
involved
engineers, aerodrome staff, etc.) that have an immediate adverse
in production evident
activities
aviation
byoftriggering
direct
generate
workplaces.
effect. control
factors.
and must control.
The organizational accident
Organizational processes
Policy-making
Planning
Communication
Allocation of resources
Supervision
 ...
Activities over which any organization has a reasonable degree

of direct control
 Inadequate hazard
identification and risk
management
 Normalization of
deviance
Conditions present in the system before the accident, made evident by

triggering factors.
Organizational processes
Latent
conditions
Technology
Training
Regulations Defences
Resources to protect against the risks that organizations involved

in production activities generate and must control.
 Workforce stability
 Qualifications and
experience
 Morale
 Credibility
 Ergonomics
 ...
Factors that directly influence the efficiency of people in

aviation workplaces.
Errors
Violations
Actions or inactions by people (pilots, controllers, maintenance engineers,

aerodrome staff, etc.) that have an immediate adverse effect.
The perspective of the organizational accident
Improve Identify
Monitor
Reinforce
Contain

People and safety
 Aviation workplaces involve
complex interrelationships
among its many
components
 To understand operational
performance, we must
understand how it may be
affected by the
interrelationships among
the various components
of the aviation work places Source: Dedale

A
Understand
human performance
within the
contextt
operational contex
where it takes place
where
B
Processes and outcomes
Causes and
consequences
of operational
errors are not
linear in their
magnitude
Source: Dedale

The SHEL(L) model
Understanding the relationship between people and operational
contexts
 Software
S
S  Hardware
 Environment
HH L LLL
 Liveware
E
E  Liveware, other
persons
Operational performance and technology
 In production-intensive
industries like contemporary
aviation, technology is
essential
 As a result of the massive
introduction of technology,
the operational
consequences of the
interactions between people
and technology are often
overlooked, leading to
human error
Understanding operational errors
 Human error is considered
contributing factor in most
aviation occurrences
 Even competent personnel
commit errors
 Errors must be accepted as
a normal component of any
system where humans and
technology interact

Errors and safety – A non linear relationship
Statistically, millions of
operational errors are made
before a major safety
breakdown occurs
Source: Dedale

Accident investigation – Once in a million flights
Unh Inci
Fla
ps o
Che
ckli eed acc dent /
mitt st fa ed iden
ed ilure w arn t
ing
Error Deviation Amplification Degradation /

breakdown

Safety management – On almost every flight
Fla Che Effe

ps o c kl i ctiv
mitt st w ew
ed ork arn
s ing
Error Deviation Amplification Normal flight

Three strategies for the control of human error
 Error reduction strategies
intervene at the source of
the error by reducing or
eliminating the contributing
factors
Human-centred design
Ergonomic factors
Training
…

 Error capturing strategies
intervene once the error has
already been made,
capturing the error before it
generates adverse
consequences
Checklists
Task cards
Flight strips
…

 Error tolerance strategies
intervene to increase the
ability of a system to accept
errors without serious
consequence
System redundancies
Structural inspections
…

Understanding violations – Are we ready?
logy Accident
High hno
Tec raining ns Incident
T
g ulatio
Re System’s
production
objective(s)
Exceptional violation space

Risk
Violation space
Low
Minimum System output Maximum
Culture
 Culture binds people together as members of groups and

provides clues as to how to behave in both normal and
unusual situations
 Culture influences the values, beliefs and behaviours that
people share with other members of various social groups

Three cultures
National
Organizational
National
Professional

Three distinct cultures
 National culture encompasses the value system of particular
nations
 Organizational/corporate culture differentiates the values
and behaviours of particular organizations (e.g. government
vs. private organizations)
 Professional culture differentiates the values and behaviours
of particular professional groups (e.g. pilots, air traffic
controllers, maintenance engineers, aerodrome staff, etc.)
 No human endeavour is culture-free

Organizational/corporate culture
 Sets the boundaries for acceptable behaviour in the
workplace by establishing norms and limits
 Provides a frame work for managerial and employee
decision-making
“This is how we do things here, and how we talk about
the way we do things here”
 Organizational/corporate culture shapes – among many
others – safety reporting procedures and practices by
operational personnel

Safety culture
 A trendy notion with potential for misperceptions and
misunderstandings
 A construct, an abstraction
 It is the consequence of a series of organizational
processes (i.e., an outcome)
 Safety culture is not an end in itself, but a means to
achieve an essential safety management prerequisite:
 Effective safety reporting

Effective safety reporting – Five basic traits
Information Flexibility
People are knowledgeable about the human, technical and People can adapt reporting
when facing unusual
organizational factors that determine the safety of the system circumstances, shifting from
as a whole. the established mode to a
direct mode thus allowing
Willingness information to quickly reach
the appropriate decision-
People are willing to making level.
Effective safety
report their errors and
reporting
experiences.
Learning
People have the competence
to draw conclusions from
Accountability safety information systems
and the will to implement
People are encouraged (and rewarded) for providing essential
major reforms.
safety-related information. However, there is a clear line that
differentiates between acceptable and unacceptable behaviour.

Three options Source: Ron Westrum
 Organizations and the management of information
Pathological – Hide the information
Bureaucratic – Restrain the information
Generative – Value the information

Three possible organizational cultures
Source: Ron Westrum
Pathological Bureaucratic Generative
Information Hidden Ignored Sought
Messengers Shouted Tolerated Trained
Responsibilities Shirked Boxed Shared
Reports Discouraged Allowed Rewarded
Failures Covered up Merciful Scrutinized
New ideas Crushed Problematic Welcomed

Resulting Conflicted “Red tape” Reliable
organization organization organization organization

Safety investigation
 For “funereal” purposes
To put losses behind
To reassert trust and faith in the system
To resume normal activities
To fulfil political purposes
 For improved system reliability
To learn about system vulnerability
To develop strategies for change
To prioritize investment of resources

Investigation
 The facts
An old generation four engine turboprop freighter flies
into severe icing conditions
Engines 2 and 3 flameout as consequence of ice
accretion, and seven minutes later engine 4 fails
The flight crew manages to re-start engine number 2
Electrical load shedding is not possible, and the electrical
system reverts to battery power
...

Investigation
 ... The facts
While attempting to conduct an emergency landing, all
electrical power is lost
All that is left to the flight crew is the self-powered
standby gyro, a flashlight and the self-powered engine
instruments
The flight crew is unable to maintain controlled flight, and
the aircraft crashes out of control

Investigation
 Findings
Crew did not use the weather radar
Crew did not consult the emergency check-list
Demanding situation requiring decisive thinking and clear
action
Conditions exceeded certification condition for the
engines
Did not request diversion to a closer aerodrome
...

Investigation
 ... Findings
Crew did not use correct phraseology to declare
emergency
Poor crew resource management (CRM)
Mismanagement of aircraft systems
Emergency checklist – presentation and visual
information
Flight operations internal quality assurance procedures

Investigation
 Causes
Multiple engine failures
Incomplete performance of emergency drills
Crew actions in securing and re-starting engines
Drag from unfeathered propellers
Weight of ice
Poor CRM
Lack of contingency plans
Loss of situational awareness

Investigation
 Safety recommendations
Authority should remind pilots to use correct phraseology
Authority should research into most effective form of

presentation of emergency reference material

Investigation
 The facts
An old generation two engine turboprop commuter
aircraft engaged in a regular passenger transport
operation is conducting a non-precision approach in
marginal weather conditions in an uncontrolled, non-
radar, remote airfield
The flight crew conducts a straight-in approach, not
following the published approach procedure
…

Investigation
 ... The facts

Upon reaching MDA, the flight crew does not acquire
visual references
The flight crew abandons MDA without having acquired
visual references to pursue the landing
The aircraft crashes into terrain short of the runway

Investigation
 Findings
The crew made numerous mistakes
But
Crew composition legal but unfavourable in view of
demanding flight conditions
According to company practice, pilot made a direct
approach, which was against regulations
…
Investigation
 … But
The company had consistently misinterpreted regulations
Level of safety was not commensurate with the
requirements of a scheduled passenger operation
Aerodrome operator had neither the staff nor the
resources to ensure regularity of operations
…

Investigation
 … But
Lack of standards for commuter operations
Lack of supervision of air traffic facilities
Authorities’ disregard of previous safety violations
Legislation out of date
…

Investigation
 … But
Conflicting goals within the authority
Lack of resources within the authority
Lack of aviation policy to support the authority
Deficiencies in the training system

Investigation
 Causes
Decision to continue approach below MDA without visual

contact
Performance pressures
Airline’s poor safety culture

Investigation
 Safety recommendations
“Tip-of-the-arrow” recommendations
But
Review the process of granting AOC
Review the training system
Define an aviation policy which provides support to the
task of the aviation administration
…

Investigation
 … But
Reform aviation legislation
Reinforce existing legislation as interim measure
Improve both accident investigation and aircraft and

airways inspection processes

Errors ...
… are like mosquitoes …

To fight them …
... drain their breeding swamps.

Basic safety concepts
Questions and answers

 Q: How is safety defined in Document 9859?
 A:
Safety is the state in which the risk of harm to persons or
property damage is reduced to, and maintained at or
below, an acceptable level through a continuing process
of hazard identification and risk management.
Slide number: 7

 Q: Enumerate the five building blocks of the organizational
accident.
 A:
Slide number: 16
 Q: Explain the components of the SHEL(L) Model.
 A:
 Software
S  Hardware
 Environment
H L L  Liveware
 Liveware, other
E persons
Slide number: 20
 Q: Enumerate three basic traits underlying effective safety
reporting.
 A: Information Flexibility
People are knowledgeable about the human, technical and People can adapt reporting
organizational factors that determine the safety of the system as a when facing unusual
whole. circumstances, shifting from the
established mode to a direct
Willingness mode thus allowing information
to quickly reach the appropriate
People are willing to report Effective safety decision-making level .
their errors and reporting
experiences. Learning
People have the competence to

Accountability draw conclusions from safety
information systems and the will
People are encouraged (and rewarded) for providing essential safety- to implement major reforms.
related information. However, there is a clear line that differentiates
between acceptable and unacceptable behaviour.
Slide number: 35
 Q: How can organizations be characterized, depending
upon their management of safety information?
 A:
Pathological – Hide the information
Bureaucratic – Restrain the information
Generative – Value the information
Slide number: 36

Points to remember
1. The organizational accident.

2. Operational contexts and human performance
3. Errors and violations.
4. Organizational culture and effective safety reporting.
5. The management of safety information.

Basic safety concepts
Exercise 02/01 – The Anytown City Airport accident
(Handout Nº 1)

The Anytown City Airport accident
 In the late hours of a summer Friday evening, while landing
on a runway heavily contaminated with water, a twin-engine
jet transport aircraft with four crew members and 65
passengers on board overran the westerly end of the
runway at Anytown City airport
 The aircraft came to rest in the mud a short distance beyond
the end of the runway. There were no injuries to crew or
passengers, and there was no apparent damage to the
aircraft as a consequence of the overrun
 However, a fire started and subsequently destroyed the
aircraft
 Group activity:
A facilitator will be appointed, who will coordinate the
discussion
A summary of the discussion will be written on flip charts,
and a member of the group will brief on their findings in a
plenary session
 Required task:
Read the text related to the accident of the twin-engined
jet transport at Anytown City Airport
…

 … required task:
 From the investigation report of the above accident,
you should identify:
1. Organizational processes that influenced the
operation and which felt under the responsibility of
senior management (i.e. those accountable for the
allocation of resources)
2. Latent conditions in the system safety which
became precursors of active failures
3. Defences which failed to perform due to
weaknesses, inadequacies or plain absence …

 … required task:
4. Workplace conditions, which may have influenced

operational personnel actions; and
5. Active failures, including errors and violations

 When you have concluded the above, your task is to
complete the Table 02/01 – Analysis (Handout N° 1)
classifying your findings in accordance with the
organizational accident model


Module N° 2 – Basic safety
concepts
Revision N° 13 ICAO Safety Management Systems (SMS) Course 06/05/09

ICAO SMS M 02 - Basic Safety (R013) 09 (E)

Uploaded by

Copyright:

Available Formats

ICAO SMS M 02 - Basic Safety (R013) 09 (E)

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ICAO SMS M 02 - Basic Safety (R013) 09 (E)

Uploaded by

Copyright:

Available Formats

Module N° 2 – Basic safety

Revision N° 13 ICAO Safety Management Systems (SMS) Course 06/05/09

System Module 8 Module 9

Module 5 Module 6 Module 7

Module 1 Module 22 Module 3

Module N° 2 ICAO Safety Management Systems (SMS) Course 2

 At the end of this module, participants will be able to explain

Module N° 2 ICAO Safety Management Systems (SMS) Course 3

Module N° 2 ICAO Safety Management Systems (SMS) Course 4

Module N° 2 ICAO Safety Management Systems (SMS) Course 5

Module N° 2 ICAO Safety Management Systems (SMS) Course 6

 Safety is the state in which the risk of harm to persons or

property damage is reduced to, and maintained at or below,

an acceptable level through a continuing process of hazard

identification and risk management

Module N° 2 ICAO Safety Management Systems (SMS) Course 7

WHAT? WHO? WHEN?

But not always discloses:

Module N° 2 ICAO Safety Management Systems (SMS) Course 8

Module N° 2 ICAO Safety Management Systems (SMS) Course 9

Latent conditions trajectory

Activities over which any organization has a reasonable degree

Conditions present in the system before the accident, made evident by

Resources to protect against the risks that organizations involved

Factors that directly influence the efficiency of people in

Actions or inactions by people (pilots, controllers, maintenance engineers,

Module N° 2 ICAO Safety Management Systems (SMS) Course 16

Module N° 2 ICAO Safety Management Systems (SMS) Course 17

Module N° 2 ICAO Safety Management Systems (SMS) Course 19

Module N° 2 ICAO Safety Management Systems (SMS) Course 22

Module N° 2 ICAO Safety Management Systems (SMS) Course 23

Error Deviation Amplification Degradation /

Module N° 2 ICAO Safety Management Systems (SMS) Course 24

Fla Che Effe

Error Deviation Amplification Normal flight

Module N° 2 ICAO Safety Management Systems (SMS) Course 25

Module N° 2 ICAO Safety Management Systems (SMS) Course 26

Module N° 2 ICAO Safety Management Systems (SMS) Course 27

Module N° 2 ICAO Safety Management Systems (SMS) Course 28

Exceptional violation space

 Culture binds people together as members of groups and

Module N° 2 ICAO Safety Management Systems (SMS) Course 30

Module N° 2 ICAO Safety Management Systems (SMS) Course 31

Module N° 2 ICAO Safety Management Systems (SMS) Course 32

Module N° 2 ICAO Safety Management Systems (SMS) Course 33

Module N° 2 ICAO Safety Management Systems (SMS) Course 34

Module N° 2 ICAO Safety Management Systems (SMS) Course 35

 Organizations and the management of information

Pathological – Hide the information

Bureaucratic – Restrain the information

Generative – Value the information

Module N° 2 ICAO Safety Management Systems (SMS) Course 36

Pathological Bureaucratic Generative

Information Hidden Ignored Sought

Messengers Shouted Tolerated Trained

Responsibilities Shirked Boxed Shared

Reports Discouraged Allowed Rewarded

Failures Covered up Merciful Scrutinized